The Agent Risk Ledger.

A machine-readable risk record for any AI agent a public body is about to deploy or buy: what it can do, what it can spend, how stale its evidence is, how it is monitored, how it is stopped, and how confident its outputs are. This is a proposition for Sovereign AI R&D Procurement Scheme Challenge 4, Safe AI Agent Adoption (NCSC's focus area within the scheme) -- not a claim that the ledger exists today.

THE CHALLENGE

Public bodies are being asked to adopt AI agents faster than they can currently assure them.

Challenge 4 of the Sovereign AI R&D Procurement Scheme is Safe AI Agent Adoption, sponsored by NCSC. The problem it targets is real and general: an agent's capability, spend authority and evidence quality can all change between the point a public body approves it and the point it is actually running in production, and there is rarely a single, comparable, machine-readable record of what was approved, what changed and what would trigger a stop.

Our proposition is not a generic AI-safety framework. It is a specific, narrow record format -- the Agent Risk Ledger -- that any public body could require from any agent vendor, including us, before or during deployment.

THE RISK-RECORD SCHEMA

Six fields, not a framework.

The schema stays deliberately small so it can be produced and checked, rather than becoming another compliance document nobody reads. Each field below is a proposed record field, not a shipped API.

Field	What it records
Capability surface	What the agent can do: which tools, data sources and downstream systems it can read from or act on, declared explicitly rather than inferred from behaviour.
Spend surface	Any budget, payment or resource-consumption limit the agent can trigger, and the approval chain required to raise it.
Evidence staleness	The age and source of the evidence behind the agent's most recent decisions, so a reviewer can see when confidence should degrade.
Monitoring hook	A live, machine-checkable signal (health, error rate, drift) a public body's own tooling can poll independently of the vendor's word.
Kill-switch control	A documented, tested way to immediately stop the agent acting, separate from and not dependent on the agent's own code path.
Decision output with stated uncertainty	Every consequential output states its confidence and what would invalidate it, rather than presenting a single confident answer.

OPEN-SOURCE INTENT

We intend to publish the schema and a reference implementation as open source.

A risk-record format that only Edge Agents can produce or read is not infrastructure a government can rely on. If this proposition proceeds, the record schema and a reference validator are intended for publication under an open licence so any vendor -- not only us -- can adopt it, and any public body can verify a record independently of the vendor that produced it.

EXISTING EVIDENCE

We already run agent governance controls on our own engineering work.

The Agent Risk Ledger's fields are not invented in the abstract: several map directly to controls we already run on our own autonomous engineering agent today -- an approval gate, a bounded change policy, an observe-only audit trail and a kill switch. See how we govern our own agents for the mapped, checkable detail.

Last reviewed: 4 September 2026.